From nobody Mon Feb 9 01:45:37 2026 Received: from NAM10-DM6-obe.outbound.protection.outlook.com (mail-dm6nam10on2079.outbound.protection.outlook.com [40.107.93.79]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 670471F583D; Tue, 22 Apr 2025 09:26:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.93.79 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745313986; cv=fail; b=DnHThtca4ynEq/UiZDztbPyT5xLUmep2miDuJmpkTh7MZRWlShNDJtBr32g/cuhbPqZRzgBTLc2DrzunIOrbmI9vByWqHvlOPYSS3sjZtrMrz0RrNeImrSrPgYE2mBWgmkklYpBqdnegvtkyCq3TpDjCcxsJSVHz9ZrMhX5Lii4= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745313986; c=relaxed/simple; bh=sh1VIWrtNNjUMxvYH4F/UB2ZL3oRjtylZIbj9eMGDOY=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=XpszGefF4LGug8Ubq3X62HRx9VCjfN65yC2OiwQO03xx2UbjwAbgX+kEsmyF/SUrbuCPGaqevCftS+Xt5tfa6t7Ljfj9zwZknapU+o7Ci6vNqyUrIwnz5W6V9FvkZfGMkY++BysCpoJ24rBpqyQS06hJMFuIy9u2t08mkszXeuo= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=ZlX6bPiZ; arc=fail smtp.client-ip=40.107.93.79 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="ZlX6bPiZ" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=SFt/0cPJrVOGEe44fBaK+x4EXHzASLa/3gs0angINtyv5lpMfR9veEmZKWffw0s188GiBItqZ9x0EZe+DOikGV5PgaMS/EdtflyCmUBEd+lEUUSgM/ZaSQNOGiAG5CrFwsddCttjtqiKcWxGZvyql247G+yeNXPLcmoj3dUgQaAf3MA0bakHBVjh2dUE7g3Jw5jX9hycftZ7qRsLdcotFcXIEbgb9Cw725cjGHPYM0tfpkybDUeWhyXpvTPZXYObCrQYvuAog/Zt7DZdt4cWYXMMWtJjoApajwiN+4WdfoYG0UsNKeVLvWz/rQMSY5oltM8F89Cfs8KSSrtH+J47tQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=U16MJFxlDUV+d56xlMRJQuRXufm9fjaou4jK6AYDdNs=; b=aeLEfPUdjTLvE0W/tI3OCGmZE14A/wbG/55+G1IJnUAHDSutwJpK5UVbJBVV+uj4zVCVnoFX5vpr1HYuTUlxPZ07xejSRjWpKNu4vDBsAMrdBslQsQKF1zj7J8NnOPKHCsDU2aeQ8tkQgHBecZ1qPkUyAQE4IAYSlc5tQTNZ+fs+p3xdgHzjmzMt6LIZWBQlpqr/+5xxon+G7mSZxdo8cb0h8TyidS3jo4ViyrtClLUtDK3sAtNhSRWFleF3M2PLdnbUpQl7a3hOS8Fz2SGHqp/L5QxEmINe3hq6WR0MkSU43WYLeU3p2P8QnJE7gBZNeecUMYdDE5APZS6CXiVTXg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=davemloft.net smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=U16MJFxlDUV+d56xlMRJQuRXufm9fjaou4jK6AYDdNs=; b=ZlX6bPiZrzl0du1kVoAW898lqrarxABJz93qTMFasXGXBTswojndegVG0o4ZwEWoKuBr3US9msum6i/5/HwSGzhNuWE+Zv2wkSzvmCTQZbIJ0hZApcuHCXd2ZkCw5Pv93oLO3/E9MInl83u8frmJkxo0ChurftAPT8xOaNfCX192Ls6VOOMsdYn4Y9/P7sUBtWezmYAK9qQviMJ9phWWqz1/b8cl1mdjrVCwXB6JqhxSUdYYSkwyOUw5YQGVnQ0djOhJtjdKA1ia/Tma3haEbJKsHThR7uaRpVbX9+gq0jbc5oy6ZlxN145lpEbl+s8fzthEcZHXHeO+ZxP5Yt5mlg== Received: from BYAPR07CA0106.namprd07.prod.outlook.com (2603:10b6:a03:12b::47) by LV8PR12MB9110.namprd12.prod.outlook.com (2603:10b6:408:18b::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8655.35; Tue, 22 Apr 2025 09:26:19 +0000 Received: from CO1PEPF000044F1.namprd05.prod.outlook.com (2603:10b6:a03:12b:cafe::4c) by BYAPR07CA0106.outlook.office365.com (2603:10b6:a03:12b::47) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8655.35 via Frontend Transport; Tue, 22 Apr 2025 09:26:18 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by CO1PEPF000044F1.mail.protection.outlook.com (10.167.241.71) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8655.12 via Frontend Transport; Tue, 22 Apr 2025 09:26:17 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Tue, 22 Apr 2025 02:25:54 -0700 Received: from rnnvmail205.nvidia.com (10.129.68.10) by rnnvmail204.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.14; Tue, 22 Apr 2025 02:25:53 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.10) with Microsoft SMTP Server id 15.2.1544.14 via Frontend Transport; Tue, 22 Apr 2025 02:25:50 -0700 From: Mark Bloch To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet , Andrew Lunn CC: Saeed Mahameed , Tariq Toukan , "Leon Romanovsky" , , , , Vlad Dogaru , Yevgeny Kliteynik , Mark Bloch Subject: [PATCH net-next 1/3] net/mlx5: HWS, Fix IP version decision Date: Tue, 22 Apr 2025 12:25:38 +0300 Message-ID: <20250422092540.182091-2-mbloch@nvidia.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250422092540.182091-1-mbloch@nvidia.com> References: <20250422092540.182091-1-mbloch@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: AnonymousSubmission X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CO1PEPF000044F1:EE_|LV8PR12MB9110:EE_ X-MS-Office365-Filtering-Correlation-Id: 2a684153-f172-4020-3a29-08dd817fbc83 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|82310400026|36860700013|1800799024; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?x85PN9GzSjTrfoNX4gA8uCxc33prT4JxTJHVKy+ETPyGkS/9KPDmV0e6Q6NI?= =?us-ascii?Q?JErX4lJI5NIfUI4qwLBO8mMzAjXltgM3eN0EJ+fxf7LaebeLC8jfXs3bWJr2?= =?us-ascii?Q?PA1aS6CPXRV9iH00ec2UGUNuDnHO/lxg+BvB0eVkxQcD9uE1VzHe4pPaWUCs?= =?us-ascii?Q?ftbfm9D4lvIIOpuPfZQDIAgAhmnquIqyv0YGruPEkT2CoSshN9GX04Db4WWj?= =?us-ascii?Q?ml5pM82wtoJYYTwbUoKFoQx9i1+CS2Gq2PjgoP+6uBAO3DbvvKga9HP844zV?= =?us-ascii?Q?1PA+eP8qJFTqkhbaQP4l5raEIswwL7amtqSradW9lOUtobaIX1IXiNPO+c6T?= =?us-ascii?Q?rA4cU5SNO9K7j1dUOKlP14CjufDe2Y2vOPFXxKEp4VEjM4EhRdhZn6aj5iAu?= =?us-ascii?Q?a2HLvZjqq0UZJMSa8UCaDoG9cZLGTK3TSAuRYQh5jW3sKE0hhBQ19oieMsBW?= =?us-ascii?Q?iQrPXm2NTnyXylrgf0snKLJe3Hewi2BxSE1wwBNiMautAOyML/0jurj3jA+n?= =?us-ascii?Q?ExENSlhLmqhKhXLlIRfxHWQ1ch6TbWkkxYaPpIsXkMJjyjP744pxYrrPbgxB?= =?us-ascii?Q?5I5AoYO1gRVREUFC8MgPeSeYDAEVSdsSP5KqVNF9WrhkJ2u1Ex7TFHI/JPbK?= =?us-ascii?Q?UfUswaWJdSYMBXShg63M+wU5G15NlmTFyA3s5LZaF/884Sg58sv04UxqLWt1?= =?us-ascii?Q?ICUz+TbODahTDGU9RcFw/rLOwn8Ujq7Luh22ZVn34SebYQcWPrHC7NmbEtW1?= =?us-ascii?Q?DWvRrywnopLthyi0hrMcyAj9Yw7Q79doBnv31i+vELDSTLiJoZc5UisNRXDg?= =?us-ascii?Q?G4tHlZGjMo8qV09XvqGfqtOy8b44TUiuqiOaHs5N7eTajZneB+K+WZx8MGqQ?= =?us-ascii?Q?TBCdwgGa8T8N3bzwVe2CYj9S3IYnlwuSZicpHaGrI28Y+3CNj/Rfp7N5QxCx?= =?us-ascii?Q?IAIaBXPUOou1glRjw/8O3nAaB8NIAV9n3xn3Y6SHq2q7U6rzK8AzH77PXYjo?= =?us-ascii?Q?SPf/5qVYEprGbnGkk7ydQDgjkmU5MUN2hqscYl5JGv4upKseyc2TZiAAdoqL?= =?us-ascii?Q?KYBStgak4m0T0KIY+Py+XR2EtQggDtpQusmxvUFJ5JUKMtpaimwX8fY6wkUz?= =?us-ascii?Q?gR8+sXFBZzIJSJqwjP6+dM0UsMBJGr/lgd0bbYO8aXqcoPHUTHjp3W3k2xaC?= =?us-ascii?Q?R1nO9lZU2GUP3pOs/J3qlpvJC+DSXz7dBisWN5leOxRihP4Ydd10R5KANKkJ?= =?us-ascii?Q?O3THgUPgO3JVue9SSCbOkLlfZKxlpoOlj7W0jEuqjXzUfLGhcsVUMs1tYqu7?= =?us-ascii?Q?Nk1wWv0acXW0SaulYdnospRVPE4jAsxP9ZdjETcHT6EfXftwheGByLnbzL0r?= =?us-ascii?Q?HMyqjBCDkIs4Nec+i1fQooYKfrvi0iGzem2GwvRaFA1JmjpsmZxIDiZl0/CU?= =?us-ascii?Q?qjc5dCs9vk4hfwMGDOpKz8OWzgW7pu9OzaZSwTB/16GylcjDV3z5Jcic3quq?= =?us-ascii?Q?Hiw1FkuPBolrCBYGvgMPy0fNgnCQGlaxc1r0?= X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(376014)(82310400026)(36860700013)(1800799024);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Apr 2025 09:26:17.9087 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 2a684153-f172-4020-3a29-08dd817fbc83 X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CO1PEPF000044F1.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV8PR12MB9110 Content-Type: text/plain; charset="utf-8" From: Vlad Dogaru Unify the check for IP version when creating a definer. A given matcher is deemed to match on IPv6 if any of the higher order (>31) bits of source or destination address mask are set. A single packet cannot mix IP versions between source and destination addresses, so it makes no sense that they would be decided on independently. Signed-off-by: Vlad Dogaru Reviewed-by: Yevgeny Kliteynik Signed-off-by: Mark Bloch --- .../mellanox/mlx5/core/steering/hws/definer.c | 38 ++++++++----------- 1 file changed, 16 insertions(+), 22 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c= b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c index c8cc0c8115f5..5257e706dde2 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c @@ -509,9 +509,9 @@ static int hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, u32 *match_param) { - bool is_s_ipv6, is_d_ipv6, smac_set, dmac_set; struct mlx5hws_definer_fc *fc =3D cd->fc; struct mlx5hws_definer_fc *curr_fc; + bool is_ipv6, smac_set, dmac_set; u32 *s_ipv6, *d_ipv6; =20 if (HWS_IS_FLD_SET_SZ(match_param, outer_headers.l4_type, 0x2) || @@ -570,10 +570,10 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_da= ta *cd, outer_headers.dst_ipv4_dst_ipv6.ipv6_layout); =20 /* Assume IPv6 is used if ipv6 bits are set */ - is_s_ipv6 =3D s_ipv6[0] || s_ipv6[1] || s_ipv6[2]; - is_d_ipv6 =3D d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; + is_ipv6 =3D s_ipv6[0] || s_ipv6[1] || s_ipv6[2] || + d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; =20 - if (is_s_ipv6) { + if (is_ipv6) { /* Handle IPv6 source address */ HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_O, outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_127_96, @@ -587,13 +587,6 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_dat= a *cd, HWS_SET_HDR(fc, match_param, IPV6_SRC_31_0_O, outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, ipv6_src_outer.ipv6_address_31_0); - } else { - /* Handle IPv4 source address */ - HWS_SET_HDR(fc, match_param, IPV4_SRC_O, - outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, - ipv4_src_dest_outer.source_address); - } - if (is_d_ipv6) { /* Handle IPv6 destination address */ HWS_SET_HDR(fc, match_param, IPV6_DST_127_96_O, outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_127_96, @@ -608,6 +601,10 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_dat= a *cd, outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0, ipv6_dst_outer.ipv6_address_31_0); } else { + /* Handle IPv4 source address */ + HWS_SET_HDR(fc, match_param, IPV4_SRC_O, + outer_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, + ipv4_src_dest_outer.source_address); /* Handle IPv4 destination address */ HWS_SET_HDR(fc, match_param, IPV4_DST_O, outer_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0, @@ -665,9 +662,9 @@ static int hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, u32 *match_param) { - bool is_s_ipv6, is_d_ipv6, smac_set, dmac_set; struct mlx5hws_definer_fc *fc =3D cd->fc; struct mlx5hws_definer_fc *curr_fc; + bool is_ipv6, smac_set, dmac_set; u32 *s_ipv6, *d_ipv6; =20 if (HWS_IS_FLD_SET_SZ(match_param, inner_headers.l4_type, 0x2) || @@ -728,10 +725,10 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_da= ta *cd, inner_headers.dst_ipv4_dst_ipv6.ipv6_layout); =20 /* Assume IPv6 is used if ipv6 bits are set */ - is_s_ipv6 =3D s_ipv6[0] || s_ipv6[1] || s_ipv6[2]; - is_d_ipv6 =3D d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; + is_ipv6 =3D s_ipv6[0] || s_ipv6[1] || s_ipv6[2] || + d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; =20 - if (is_s_ipv6) { + if (is_ipv6) { /* Handle IPv6 source address */ HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_I, inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_127_96, @@ -745,13 +742,6 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_dat= a *cd, HWS_SET_HDR(fc, match_param, IPV6_SRC_31_0_I, inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, ipv6_src_inner.ipv6_address_31_0); - } else { - /* Handle IPv4 source address */ - HWS_SET_HDR(fc, match_param, IPV4_SRC_I, - inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, - ipv4_src_dest_inner.source_address); - } - if (is_d_ipv6) { /* Handle IPv6 destination address */ HWS_SET_HDR(fc, match_param, IPV6_DST_127_96_I, inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_127_96, @@ -766,6 +756,10 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_dat= a *cd, inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0, ipv6_dst_inner.ipv6_address_31_0); } else { + /* Handle IPv4 source address */ + HWS_SET_HDR(fc, match_param, IPV4_SRC_I, + inner_headers.src_ipv4_src_ipv6.ipv6_simple_layout.ipv6_31_0, + ipv4_src_dest_inner.source_address); /* Handle IPv4 destination address */ HWS_SET_HDR(fc, match_param, IPV4_DST_I, inner_headers.dst_ipv4_dst_ipv6.ipv6_simple_layout.ipv6_31_0, --=20 2.34.1 From nobody Mon Feb 9 01:45:37 2026 Received: from NAM10-MW2-obe.outbound.protection.outlook.com (mail-mw2nam10on2088.outbound.protection.outlook.com [40.107.94.88]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7B89A1F8AD3; Tue, 22 Apr 2025 09:26:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.94.88 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745313989; cv=fail; b=bAdNUCAS1dxWdqCG5eQnsFhSoH8FsbtIYm02iqc2WZ4X1fksTlCSZeaaO6jM9xB6kaxfvKdvMYGvQjGKv56b3/f5l+QKNjRNadpj4i0Uip+jTwOX5n6nkHAWyGOxBsQ/ZKdptiN+xKtE2NczOSazeWXcyGMmn1PqcwNRgykFdMs= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745313989; c=relaxed/simple; bh=THquBSAfYacXWS+9tpCZKZ0H5Gv7/pavCAjRXfYqNnI=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=pI5ICig1JO4hsvPiSppIkK+s2x3cCyut0tZHV8+u2r7Ob4z3ZGpPp866V6OIRsd2ImvBXzhZgwGF2ZXIL+Koc3H6Ltqu2utJFsZkcs0hEMnNUPIu6lbyC6AtnvVdqG+XmZEWmfyA3cjiqIuYiap3/cPEKOwxt4UxKWWZLdznjJo= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=mcsVw013; arc=fail smtp.client-ip=40.107.94.88 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="mcsVw013" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=sg2PjVprInlOeljA0FKYrKT6l0H3PdYtP9ynOM90aSwBM2B62COdgGT6iza+Nb6ccoferum3ZXoLr9tp3bzKmsaTx4NcSFBXt+tq6eTYVcaK1ZMV5MqlXowoiBQv3hswCZ3phWWpTB/1kpJ6WvhCbO0GqjpXbNMDr7Pf3PMwhPgNdldiiHaf6GbOmrmO9uEY0ygxzz/5xRNezzlrUDkjU0pbAp7b1PqxNy4T5WQ3lNOAGngffMS6FWfT24OarY5jIvzkQSlQdOlFC603y2lD82YNJqL0erYiVojcZJVFdk4C0xFPH8NS/GMHbOggAD9d9xp1MQ6fjCB/mv5f6X9mcg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=EQ6u1iq1rRGgNZPR+l3Xwhhp8EswpY/r77Ef7PgzGYM=; b=eoh/ltlsBqUel6mt3YHKij1ch8yLj4NiJOLLZPplo4AaBnZb21zK8wF1KJSvsPjaZ4bMEjiR9NqzI8iDXPSW0wpuN3viWKvfKSQ1ujF/pNcLYbpYoYqImIldwqd/3b7abYYDiuVz6KRMJDOKcT7fmexr3+kcI2ZeiNo8tOfQ/4gnyG3xcCF4T8GW/lu/xlVED/oFRPWW+U9E0OAA0uRSTSYxuz4dHN1etJKg0fToS4a2HX/9v7H1m4yS8izqsvHFpCtzxSE6T4GMVzgb09kgAgsNTsU86J/XfYwFmI/Ei/zK2fvf3a9LpYcC6mEeCycRWPKR0I80Ag+Ts2h9gyfgTQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=davemloft.net smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=EQ6u1iq1rRGgNZPR+l3Xwhhp8EswpY/r77Ef7PgzGYM=; b=mcsVw013sM4Qk3vibmCGvmFXRQVw3x46r4a9AskdwrU40UhxeTZU5cj+e2RxYHCI9XsZa1fqTTFw0ADSb76Tt4sa34qmqxom4uVVxCny/KWDvh8te8Q7ESzj0zOlf59Bg1SckqY/zFHpD6fX9E195Bi6zmUKmOA2UnZ9WLADMtIKps9/MihHnNxknz5idYTjjlKfH0+bfPmqK4140Y9DNqGtVBSeSyCbHwHDL/W5+e8hMCW1BVK8GHDuVV2zxeY1pbVovHJCt5g4hCUjVP3rNKHG+TaAfuSyqORvS7lOl9va/Kco5IiT3RvVJi8MVNxxXOkQw0w2081Fl0guRuMfuQ== Received: from BYAPR01CA0013.prod.exchangelabs.com (2603:10b6:a02:80::26) by SN7PR12MB7884.namprd12.prod.outlook.com (2603:10b6:806:343::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8655.33; Tue, 22 Apr 2025 09:26:23 +0000 Received: from CO1PEPF000044F5.namprd05.prod.outlook.com (2603:10b6:a02:80:cafe::2e) by BYAPR01CA0013.outlook.office365.com (2603:10b6:a02:80::26) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8655.36 via Frontend Transport; Tue, 22 Apr 2025 09:26:22 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by CO1PEPF000044F5.mail.protection.outlook.com (10.167.241.75) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8655.12 via Frontend Transport; Tue, 22 Apr 2025 09:26:22 +0000 Received: from rnnvmail204.nvidia.com (10.129.68.6) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Tue, 22 Apr 2025 02:25:59 -0700 Received: from rnnvmail205.nvidia.com (10.129.68.10) by rnnvmail204.nvidia.com (10.129.68.6) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.14; Tue, 22 Apr 2025 02:25:58 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.10) with Microsoft SMTP Server id 15.2.1544.14 via Frontend Transport; Tue, 22 Apr 2025 02:25:55 -0700 From: Mark Bloch To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet , Andrew Lunn CC: Saeed Mahameed , Tariq Toukan , "Leon Romanovsky" , , , , Vlad Dogaru , Yevgeny Kliteynik , Mark Bloch Subject: [PATCH net-next 2/3] net/mlx5: HWS, Harden IP version definer checks Date: Tue, 22 Apr 2025 12:25:39 +0300 Message-ID: <20250422092540.182091-3-mbloch@nvidia.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250422092540.182091-1-mbloch@nvidia.com> References: <20250422092540.182091-1-mbloch@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: AnonymousSubmission X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CO1PEPF000044F5:EE_|SN7PR12MB7884:EE_ X-MS-Office365-Filtering-Correlation-Id: 053d98df-0bc2-46eb-52e5-08dd817fbf2d X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700013|82310400026|376014|1800799024; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?fPD6D2EaCwdulQ1Jd1z7AYv38YrEL823P3/sXlRXGiRpc4exG+HHE2VXLVIv?= =?us-ascii?Q?rK+mJ2mvRFED0dtsR2mFIzGT1CC7l6vOF7/oAW6kWsYKkI39v6wWo6r/vPJ0?= =?us-ascii?Q?QuUAd6yTv8csOGXp1u1zPDygxwYvEPGo8VpKIIrDJZhQzquVfb+c0nQNfBUg?= =?us-ascii?Q?2JIQeJkqFIYWg3xoCRPQ6jtbEoZqYN6PwQlT3UKAuoFtBBVed5KycLbeRHJV?= =?us-ascii?Q?B45mB5DVFDj6HQdOhx7pEkq7CuPCBVRYW0kwH11LSdnpwkEO0n194gc2pJRC?= =?us-ascii?Q?1LVjZnzJTm/0gNP37DbIFbrO0QLrKrKw56ze350gBmDr+nlkmq0IS3Vnx2UI?= =?us-ascii?Q?+Cgt7ORyljj4UbTmpOtCw0EPCgeV+htuiKTXJ5XEBP6IHpoVjO9lr43YAnNL?= =?us-ascii?Q?FkCKo0xoCJhmpt3HBNxz7Nui1WH5IgzA/Mog0X2Ux680P14jBy66EbM8+PVB?= =?us-ascii?Q?fhb489cHm+svTpplRu1eich/+o16MVJA7honDYX/SWH6PZMY4/F+JBnAhAOA?= =?us-ascii?Q?DZQ7cuKlo1OPwG0S1ngsbw0tDk4G2CBErquKi01JeUlxeOJnO0mvUkRxDtJ5?= =?us-ascii?Q?LtCBP8xI/Ey3//rnlF/4qpMX+b+MTxYZXZF7v21lroC4Uv1XdxI261sPNRtE?= =?us-ascii?Q?STqlrd8++85QVESGSkn2vsDcsnlFG8zNJd9RomIBUAdmwq0oFsr+ZY7GBj5M?= =?us-ascii?Q?5/j2TGqfYnF1pmFgyAf0665vgCCeEa4WTGzbtE7ELDml7OOeAwk7oK125iDt?= =?us-ascii?Q?IjPUToWNUJCGJeMFFqH7hBqdKoV+C5oRqRmUA8zGMLSEQzBiWQ1OEb3AK5kN?= =?us-ascii?Q?yMLgTBPhLB9YAKgKfM9P8FeeqOQaE5DT7cvyXdFIeXUMgG0fl+YH30vdTIzC?= =?us-ascii?Q?B55NO8AmTvcyUF4G2wlYNXGF9SZgIzDht07jyJG4OpA5Xlp3DMvmOT7xMogo?= =?us-ascii?Q?Stu+A56wh2JXsYj6If/hRca0yM0yJ0q3HPo6yVznMmGWCSPPlhkIgneQuUem?= =?us-ascii?Q?LZSwctLGGeLfaA+klcRIArL0D4ZEv/INgZXX8puWO8rZGlxx+smrHdk9h+xo?= =?us-ascii?Q?8jTb5ZU3p0UR5aJsSJ5L6s91c6xkY73sdspRI29LwSQdilKhh77SwIGOzORQ?= =?us-ascii?Q?wfeRDrEjbjMhxOUIArOlWyONc2k9XgN4V9gfunPs23KGwoRZdfjH2iZzpZq9?= =?us-ascii?Q?iw7FHY8RrrWB+w8hypqOsrhdu9vE9R8RMgh7N2frSrRs3WDBEaE6SsfDg1or?= =?us-ascii?Q?SZLBqa9MmjjC5VNKLgQpNJqPPHczHsZ32uH8bFK8oxfv7u35E4GgvTwhbU5Y?= =?us-ascii?Q?ioHDoHzq+6F1t1YeTnh2TXXMqdMVkWOTHbsiyd7aLXgWQmm77PZx3pPyj4Tg?= =?us-ascii?Q?QFCmBuS6YPDCdzHOiteC5uqpEH9QiQiECMEbpVcsTwKw2nbMRKCwm5HUteBn?= =?us-ascii?Q?ziWN2oeWfhghjoFrB2UZkAheFT7daiNGvaitisCBXiUyr/zFPERZbTlxwTEU?= =?us-ascii?Q?ldFwtdgo+m1B2GwwSIjYZoqIdoUG6Q4sLqPZ?= X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(36860700013)(82310400026)(376014)(1800799024);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Apr 2025 09:26:22.3320 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 053d98df-0bc2-46eb-52e5-08dd817fbf2d X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CO1PEPF000044F5.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN7PR12MB7884 Content-Type: text/plain; charset="utf-8" From: Vlad Dogaru Replicate some sanity checks that firmware does, since hardware steering does not go through firmware. When creating a definer, disallow matching on IP addresses without also matching on IP version. The latter can be satisfied by matching either on the version field in the IP header, or on the ethertype field. Also refuse to match IPv4 IHL alongside IPv6. Signed-off-by: Vlad Dogaru Reviewed-by: Yevgeny Kliteynik Signed-off-by: Mark Bloch --- .../mellanox/mlx5/core/steering/hws/definer.c | 44 ++++++++++++++++++- 1 file changed, 42 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c= b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c index 5257e706dde2..1061a46811ac 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/definer.c @@ -509,9 +509,9 @@ static int hws_definer_conv_outer(struct mlx5hws_definer_conv_data *cd, u32 *match_param) { + bool is_ipv6, smac_set, dmac_set, ip_addr_set, ip_ver_set; struct mlx5hws_definer_fc *fc =3D cd->fc; struct mlx5hws_definer_fc *curr_fc; - bool is_ipv6, smac_set, dmac_set; u32 *s_ipv6, *d_ipv6; =20 if (HWS_IS_FLD_SET_SZ(match_param, outer_headers.l4_type, 0x2) || @@ -521,6 +521,20 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_dat= a *cd, return -EINVAL; } =20 + ip_addr_set =3D HWS_IS_FLD_SET_SZ(match_param, + outer_headers.src_ipv4_src_ipv6, + 0x80) || + HWS_IS_FLD_SET_SZ(match_param, + outer_headers.dst_ipv4_dst_ipv6, 0x80); + ip_ver_set =3D HWS_IS_FLD_SET(match_param, outer_headers.ip_version) || + HWS_IS_FLD_SET(match_param, outer_headers.ethertype); + + if (ip_addr_set && !ip_ver_set) { + mlx5hws_err(cd->ctx, + "Unsupported match on IP address without version or ethertype\n"); + return -EINVAL; + } + /* L2 Check ethertype */ HWS_SET_HDR(fc, match_param, ETH_TYPE_O, outer_headers.ethertype, @@ -573,6 +587,12 @@ hws_definer_conv_outer(struct mlx5hws_definer_conv_dat= a *cd, is_ipv6 =3D s_ipv6[0] || s_ipv6[1] || s_ipv6[2] || d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; =20 + /* IHL is an IPv4-specific field. */ + if (is_ipv6 && HWS_IS_FLD_SET(match_param, outer_headers.ipv4_ihl)) { + mlx5hws_err(cd->ctx, "Unsupported match on IPv6 address and IPv4 IHL\n"); + return -EINVAL; + } + if (is_ipv6) { /* Handle IPv6 source address */ HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_O, @@ -662,9 +682,9 @@ static int hws_definer_conv_inner(struct mlx5hws_definer_conv_data *cd, u32 *match_param) { + bool is_ipv6, smac_set, dmac_set, ip_addr_set, ip_ver_set; struct mlx5hws_definer_fc *fc =3D cd->fc; struct mlx5hws_definer_fc *curr_fc; - bool is_ipv6, smac_set, dmac_set; u32 *s_ipv6, *d_ipv6; =20 if (HWS_IS_FLD_SET_SZ(match_param, inner_headers.l4_type, 0x2) || @@ -674,6 +694,20 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_dat= a *cd, return -EINVAL; } =20 + ip_addr_set =3D HWS_IS_FLD_SET_SZ(match_param, + inner_headers.src_ipv4_src_ipv6, + 0x80) || + HWS_IS_FLD_SET_SZ(match_param, + inner_headers.dst_ipv4_dst_ipv6, 0x80); + ip_ver_set =3D HWS_IS_FLD_SET(match_param, inner_headers.ip_version) || + HWS_IS_FLD_SET(match_param, inner_headers.ethertype); + + if (ip_addr_set && !ip_ver_set) { + mlx5hws_err(cd->ctx, + "Unsupported match on IP address without version or ethertype\n"); + return -EINVAL; + } + /* L2 Check ethertype */ HWS_SET_HDR(fc, match_param, ETH_TYPE_I, inner_headers.ethertype, @@ -728,6 +762,12 @@ hws_definer_conv_inner(struct mlx5hws_definer_conv_dat= a *cd, is_ipv6 =3D s_ipv6[0] || s_ipv6[1] || s_ipv6[2] || d_ipv6[0] || d_ipv6[1] || d_ipv6[2]; =20 + /* IHL is an IPv4-specific field. */ + if (is_ipv6 && HWS_IS_FLD_SET(match_param, inner_headers.ipv4_ihl)) { + mlx5hws_err(cd->ctx, "Unsupported match on IPv6 address and IPv4 IHL\n"); + return -EINVAL; + } + if (is_ipv6) { /* Handle IPv6 source address */ HWS_SET_HDR(fc, match_param, IPV6_SRC_127_96_I, --=20 2.34.1 From nobody Mon Feb 9 01:45:37 2026 Received: from NAM10-BN7-obe.outbound.protection.outlook.com (mail-bn7nam10on2081.outbound.protection.outlook.com [40.107.92.81]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A639A1FC0E6; Tue, 22 Apr 2025 09:26:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.107.92.81 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745313994; cv=fail; b=VR2j1lFWHtUfS82X3mtsoPjb6xvdWvOQpWTE1Ky8zzf51mcH0+E1Sq72HpMb5CCqEBt1uj6tzh69gjJcvR8Or7cASu9mS+IRpH5Afy+tSrfzte101rTcdW1xSDfmPe+XkZeCmMHLO8tRYD/daceXlSaPcXpbHdxWGhjkLCrju0w= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1745313994; c=relaxed/simple; bh=WvSmCmATlv/IvB3jY+YouK6FRwwSYGva4E/S2FiwsuU=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=FWREVN9C/CzHS2u1j/G2FCDp1BXKLFlutyon64kmkMJwGIj2PAfu4RbaDOqNLkfuWCyaYZlT5es0rOCT04lSqCHj7QjXKshkswWHTyODiPjR4I/GEpUVvG7XUrppNUOuR+b6GfoX3Sh67aUh6uk/JX4P5xoBzJsJ0jIiRG/AURg= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com; spf=fail smtp.mailfrom=nvidia.com; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b=KD6oHFUi; arc=fail smtp.client-ip=40.107.92.81 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=nvidia.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=nvidia.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=Nvidia.com header.i=@Nvidia.com header.b="KD6oHFUi" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=QW3u7Koy7aK9LAghWixDj+vG/BQBRcrcYquleHCCh1wFf4bQHlDM1VX+/Ek/7u+YMWEUkPno47H8eb8agn5krxha5kmDZctNL0d1NzYq8wmkCU8ydMEQtbD6mC9POSDB25LohXCWh2af/L1opmziyJtf9cjrJrVALvdKGJK1YGRP/VMjpJw3xNEYkZEPaV5b9qQ9dOZgSW4rEJDCQGaLRPvCIjG8/WXW0FhThLkgmaCnyV8AYzlebgTwTe+GR44+/Q7j4FfsW/yOBQB0gJQfWJiEVPxnD5QYu5f2jeUIAK/UBDIYhkafkNhG77eS4Z8HGBwiNuADhHT55UL6Dh+TJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Xg4pNtyqaNKnTtSpf+biT+9xET/FnSHRQO5Xog8MaPo=; b=La83+VbHaP/l9Ne0nKmkPXVnOS7wrmcnqw7a9zOhdOPBkiyzVWYYlG/UKVOgda9dGLAwwpX+Cz0DfsCjNTmuKiTXpfGCBccH5ufIValnOehGoWfzXVUkfFOU5RRLPkKe6WI9QAFr5ykHWObppjF/7At5Ox25geRTiNVZIBBfmju0Gr7Ls8aIa6ZyJRrIfM59wS5IeIpOSyK7PVhWt/N5WNBPxF8flPrBqt7ZBUlkzkSqtF8XaZkDv3idwwsFM0IlH7V1euMZy54kY5uoY+zzZRRFDhCVS34QG+cQREfDi4WmJv+dXvbm+3oX3akmP5vgtlpxmgK+bqUD6HodufTAcQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 216.228.117.160) smtp.rcpttodomain=davemloft.net smtp.mailfrom=nvidia.com; dmarc=pass (p=reject sp=reject pct=100) action=none header.from=nvidia.com; dkim=none (message not signed); arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=Nvidia.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=Xg4pNtyqaNKnTtSpf+biT+9xET/FnSHRQO5Xog8MaPo=; b=KD6oHFUiotDQB27W+l+lNx1rX7uZMIaNhN4biuBBgQ7jpq/YfU3iRbDAXyz7PrrelCF0Q736Obu38sL5sHwFIIvn8ugy+67Tbkhmxs7k0+rnmUJP6bxvCkKZlqaxXDBNAwqY86AkbU75i4+3FS95Nx9rDQafZ/lJ3/s6bSm/VyjLdZ8Niv5OXMRnza+k23JvPsI0hvWFDt7/YH092jNgaHsSLri8GcF/lPfoyjxvNeyl7+/SAWogA0/x4nnz84q36bOLHDw3n3J8nMneFx7preauUgOzeS4Sp37TqqdW2kIXZP2Y/EEtxM9DyQ7NIbg0pSCjALNThUZgH/+o7ah1bg== Received: from BYAPR01CA0030.prod.exchangelabs.com (2603:10b6:a02:80::43) by IA0PR12MB8716.namprd12.prod.outlook.com (2603:10b6:208:485::18) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8655.35; Tue, 22 Apr 2025 09:26:27 +0000 Received: from CO1PEPF000044F5.namprd05.prod.outlook.com (2603:10b6:a02:80:cafe::99) by BYAPR01CA0030.outlook.office365.com (2603:10b6:a02:80::43) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.20.8655.36 via Frontend Transport; Tue, 22 Apr 2025 09:26:32 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 216.228.117.160) smtp.mailfrom=nvidia.com; dkim=none (message not signed) header.d=none;dmarc=pass action=none header.from=nvidia.com; Received-SPF: Pass (protection.outlook.com: domain of nvidia.com designates 216.228.117.160 as permitted sender) receiver=protection.outlook.com; client-ip=216.228.117.160; helo=mail.nvidia.com; pr=C Received: from mail.nvidia.com (216.228.117.160) by CO1PEPF000044F5.mail.protection.outlook.com (10.167.241.75) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.8655.12 via Frontend Transport; Tue, 22 Apr 2025 09:26:27 +0000 Received: from rnnvmail203.nvidia.com (10.129.68.9) by mail.nvidia.com (10.129.200.66) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.4; Tue, 22 Apr 2025 02:26:03 -0700 Received: from rnnvmail205.nvidia.com (10.129.68.10) by rnnvmail203.nvidia.com (10.129.68.9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.2.1544.14; Tue, 22 Apr 2025 02:26:03 -0700 Received: from vdi.nvidia.com (10.127.8.10) by mail.nvidia.com (10.129.68.10) with Microsoft SMTP Server id 15.2.1544.14 via Frontend Transport; Tue, 22 Apr 2025 02:26:00 -0700 From: Mark Bloch To: "David S . Miller" , Jakub Kicinski , Paolo Abeni , Eric Dumazet , Andrew Lunn CC: Saeed Mahameed , Tariq Toukan , "Leon Romanovsky" , , , , Vlad Dogaru , Yevgeny Kliteynik , Mark Bloch Subject: [PATCH net-next 3/3] net/mlx5: HWS, Disallow matcher IP version mixing Date: Tue, 22 Apr 2025 12:25:40 +0300 Message-ID: <20250422092540.182091-4-mbloch@nvidia.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20250422092540.182091-1-mbloch@nvidia.com> References: <20250422092540.182091-1-mbloch@nvidia.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-NV-OnPremToCloud: AnonymousSubmission X-EOPAttributedMessage: 0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CO1PEPF000044F5:EE_|IA0PR12MB8716:EE_ X-MS-Office365-Filtering-Correlation-Id: 443b4696-4569-4fd9-0f67-08dd817fc1ef X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|36860700013|376014|82310400026|1800799024; X-Microsoft-Antispam-Message-Info: =?us-ascii?Q?c96UdojOAtOl3LYHdQToERdqurkevynk0ihJoATX0yMw1KVFICTGIyqNVXYy?= =?us-ascii?Q?D8w2Hywl+QmkaeRGEvDwpv8PD3O3EdS/RFSZMfaUJAMpKaF6wiTL1OJrzG++?= =?us-ascii?Q?XgSRHvffnx0v5wGRfom6OZuj2Gp6BhZ5WYtz8ufYFaie0UOnOUUr0Yif1cMw?= =?us-ascii?Q?QnaT8StErF3RjtWXtVDmvukUlzmXDNH3uIprf0eFgurFqKnY7X0vcpPZJmre?= =?us-ascii?Q?9yOqi8KTHNGCC/njOIKVL1fpPFLRmqPdi7On/PMXzqCyHam6ddW3CuuuLFH4?= =?us-ascii?Q?Xl1cNBD+/wDJ8sXb9th6K2qtP4VWjhQRMu2Y1kL6+iDSI7sAFXKuWScTFVRD?= =?us-ascii?Q?HvpJwseBqvVcAZzlVWulYHcBvluX9P6vEwYbLv3yYK6jRS2r16wgngwcieS7?= =?us-ascii?Q?Io86Vorsj/3Ac+gyNlh4xrLFZP5H/d2dP666zp6STKLfP5WhlLJcQM5UPtJj?= =?us-ascii?Q?VEsJqwVXs1qhzs7AIb6qST4nDwLdZhVKI/HDnbGod203SvpO65+ieCo2VNgG?= =?us-ascii?Q?aCEuLcJdQCn1tnu9I5RwqUJhgdP7XC2olfXMZaCpRY966cIyCuc9sSHUw8sT?= =?us-ascii?Q?cLBgSlFBJfSxFyaNeY5CpkXiLynYDNt0XoXMKmdcVmxZog1705iYXBXpcJ1s?= =?us-ascii?Q?w7HsUDaSr+aZKZeisleVU48Lx79WQpGYoJVqJSsZS1/ZT2gDr/fwTnhq59UE?= =?us-ascii?Q?j8F3v/t4lUMkRNmj0+jIA3T5BYlNWVyGxe8JiIa7hpDM7RnaZ4C4wrvlmVL1?= =?us-ascii?Q?hSHDnwIU4Lm3nXNd/2Uc4bPBsXSHeZqsgEDPaIaywLPR8WPHIjAAUCeciERW?= =?us-ascii?Q?3MnjosDMsUNPLSPI7nhpSuy0RqbkGCVwxDH47vXueZQEbIx03y8K2wj6FMlE?= =?us-ascii?Q?b5I2BMq1ath+s9IJYV9vV8lmp48wpmXuocqvgefA7mztn4i1DSLe4eWnQKJI?= =?us-ascii?Q?PXwgy19HkAnNXYOiFYu0oljqByfa2eh4/gv3IfI0NZORb5SENKb0nxQqlqrj?= =?us-ascii?Q?Vrb50zLZXUFYNkSqOkKm60vf8L47EtYBqXBKNg6aQ4dCQtI0j3LgNvPPt5m7?= =?us-ascii?Q?UeHMjU82dipvuF6mOiEdZzlzKX8dyK5rDTUt0fBMnkUHSsvdKyV7Znc3Wxqh?= =?us-ascii?Q?kyFrXOrv25uL4pbkRF55NcVqWAoYTBoolQJKnWwyh0CI023tUItja11tqqgz?= =?us-ascii?Q?NP6eOFEntJ5a7oDc+2uY6xjqTE5+GnoukEKME4J4rVXs+BhL9qEaFfHPzRX/?= =?us-ascii?Q?GYbbMSYTMRKpJAdvsHtdL85P996bmwXVxQW7ECD6xa2jslDTT/Zw4WJWywfv?= =?us-ascii?Q?i1UWNrvjlVhrHqCerhU/cNDgGUSx1t/LbavogqI8YkrkJXg47nTfCkwzEUTI?= =?us-ascii?Q?UEXhNV8nyA2jcHD4tz36HQ88Fn6NDPCOzTGxUKHWAN44appRbbuXBdPZ73gs?= =?us-ascii?Q?pmpUGKvKffJOWsqsb2f1HemNNZrNfflZQe/gbQl1VUDzZcuZ8+n+3NKFC+sF?= =?us-ascii?Q?EljRbt5PBmn1CuLjoLzyWk9PnJLmSZpLPCUl?= X-Forefront-Antispam-Report: CIP:216.228.117.160;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:mail.nvidia.com;PTR:dc6edge1.nvidia.com;CAT:NONE;SFS:(13230040)(36860700013)(376014)(82310400026)(1800799024);DIR:OUT;SFP:1101; X-OriginatorOrg: Nvidia.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 22 Apr 2025 09:26:27.0040 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 443b4696-4569-4fd9-0f67-08dd817fc1ef X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=43083d15-7273-40c1-b7db-39efd9ccc17a;Ip=[216.228.117.160];Helo=[mail.nvidia.com] X-MS-Exchange-CrossTenant-AuthSource: CO1PEPF000044F5.namprd05.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: IA0PR12MB8716 Content-Type: text/plain; charset="utf-8" From: Vlad Dogaru Signal clearly to the user, via an error, that mixing IPv4 and IPv6 rules in the same matcher is not supported. Previously such cases silently failed by adding a rule that did not work correctly. Rules can specify an IP version by one of two fields: IP version or ethertype. At matcher creation, store whether the template matches on any of these two fields. If yes, inspect each rule for its corresponding match value and store the IP version inside the matcher to guard against inconsistencies with subsequent rules. Furthermore, also check rules for internal consistency, i.e. verify that the ethertype and IP version match values do not contradict each other. The logic applies to inner and outer headers independently, to account for tunneling. Rules that do not match on IP addresses are not affected. Signed-off-by: Vlad Dogaru Reviewed-by: Yevgeny Kliteynik Signed-off-by: Mark Bloch --- .../mellanox/mlx5/core/steering/hws/matcher.c | 26 ++++ .../mellanox/mlx5/core/steering/hws/matcher.h | 12 ++ .../mellanox/mlx5/core/steering/hws/rule.c | 122 ++++++++++++++++++ 3 files changed, 160 insertions(+) diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c= b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c index 716502732d3d..5b0c1623499b 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.c @@ -385,6 +385,30 @@ static int hws_matcher_bind_at(struct mlx5hws_matcher = *matcher) return 0; } =20 +static void hws_matcher_set_ip_version_match(struct mlx5hws_matcher *match= er) +{ + int i; + + for (i =3D 0; i < matcher->mt->fc_sz; i++) { + switch (matcher->mt->fc[i].fname) { + case MLX5HWS_DEFINER_FNAME_ETH_TYPE_O: + matcher->matches_outer_ethertype =3D 1; + break; + case MLX5HWS_DEFINER_FNAME_ETH_L3_TYPE_O: + matcher->matches_outer_ip_version =3D 1; + break; + case MLX5HWS_DEFINER_FNAME_ETH_TYPE_I: + matcher->matches_inner_ethertype =3D 1; + break; + case MLX5HWS_DEFINER_FNAME_ETH_L3_TYPE_I: + matcher->matches_inner_ip_version =3D 1; + break; + default: + break; + } + } +} + static int hws_matcher_bind_mt(struct mlx5hws_matcher *matcher) { struct mlx5hws_context *ctx =3D matcher->tbl->ctx; @@ -401,6 +425,8 @@ static int hws_matcher_bind_mt(struct mlx5hws_matcher *= matcher) } } =20 + hws_matcher_set_ip_version_match(matcher); + /* Create an STE pool per matcher*/ pool_attr.table_type =3D matcher->tbl->type; pool_attr.pool_type =3D MLX5HWS_POOL_TYPE_STE; diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h= b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h index bad1fa8f77fd..8e95158a66b5 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h +++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/matcher.h @@ -50,6 +50,12 @@ struct mlx5hws_matcher_match_ste { struct mlx5hws_pool *pool; }; =20 +enum { + MLX5HWS_MATCHER_IPV_UNSET =3D 0, + MLX5HWS_MATCHER_IPV_4 =3D 1, + MLX5HWS_MATCHER_IPV_6 =3D 2, +}; + struct mlx5hws_matcher { struct mlx5hws_table *tbl; struct mlx5hws_matcher_attr attr; @@ -61,6 +67,12 @@ struct mlx5hws_matcher { u8 num_of_action_stes; /* enum mlx5hws_matcher_flags */ u8 flags; + u8 matches_outer_ethertype:1; + u8 matches_outer_ip_version:1; + u8 matches_inner_ethertype:1; + u8 matches_inner_ip_version:1; + u8 outer_ip_version:2; + u8 inner_ip_version:2; u32 end_ft_id; struct mlx5hws_matcher *col_matcher; struct mlx5hws_matcher *resize_dst; diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c b/= drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c index 9e6f35d68445..5342a4cc7194 100644 --- a/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/hws/rule.c @@ -655,6 +655,124 @@ int mlx5hws_rule_move_hws_add(struct mlx5hws_rule *ru= le, return 0; } =20 +static u8 hws_rule_ethertype_to_matcher_ipv(u32 ethertype) +{ + switch (ethertype) { + case ETH_P_IP: + return MLX5HWS_MATCHER_IPV_4; + case ETH_P_IPV6: + return MLX5HWS_MATCHER_IPV_6; + default: + return MLX5HWS_MATCHER_IPV_UNSET; + } +} + +static u8 hws_rule_ip_version_to_matcher_ipv(u32 ip_version) +{ + switch (ip_version) { + case 4: + return MLX5HWS_MATCHER_IPV_4; + case 6: + return MLX5HWS_MATCHER_IPV_6; + default: + return MLX5HWS_MATCHER_IPV_UNSET; + } +} + +static int hws_rule_check_outer_ip_version(struct mlx5hws_matcher *matcher, + u32 *match_param) +{ + struct mlx5hws_context *ctx =3D matcher->tbl->ctx; + u8 outer_ipv_ether =3D MLX5HWS_MATCHER_IPV_UNSET; + u8 outer_ipv_ip =3D MLX5HWS_MATCHER_IPV_UNSET; + u8 outer_ipv, ver; + + if (matcher->matches_outer_ethertype) { + ver =3D MLX5_GET(fte_match_param, match_param, + outer_headers.ethertype); + outer_ipv_ether =3D hws_rule_ethertype_to_matcher_ipv(ver); + } + if (matcher->matches_outer_ip_version) { + ver =3D MLX5_GET(fte_match_param, match_param, + outer_headers.ip_version); + outer_ipv_ip =3D hws_rule_ip_version_to_matcher_ipv(ver); + } + + if (outer_ipv_ether !=3D MLX5HWS_MATCHER_IPV_UNSET && + outer_ipv_ip !=3D MLX5HWS_MATCHER_IPV_UNSET && + outer_ipv_ether !=3D outer_ipv_ip) { + mlx5hws_err(ctx, "Rule matches on inconsistent outer ethertype and ip ve= rsion\n"); + return -EINVAL; + } + + outer_ipv =3D outer_ipv_ether !=3D MLX5HWS_MATCHER_IPV_UNSET ? + outer_ipv_ether : outer_ipv_ip; + if (outer_ipv !=3D MLX5HWS_MATCHER_IPV_UNSET && + matcher->outer_ip_version !=3D MLX5HWS_MATCHER_IPV_UNSET && + outer_ipv !=3D matcher->outer_ip_version) { + mlx5hws_err(ctx, "Matcher and rule disagree on outer IP version\n"); + return -EINVAL; + } + matcher->outer_ip_version =3D outer_ipv; + + return 0; +} + +static int hws_rule_check_inner_ip_version(struct mlx5hws_matcher *matcher, + u32 *match_param) +{ + struct mlx5hws_context *ctx =3D matcher->tbl->ctx; + u8 inner_ipv_ether =3D MLX5HWS_MATCHER_IPV_UNSET; + u8 inner_ipv_ip =3D MLX5HWS_MATCHER_IPV_UNSET; + u8 inner_ipv, ver; + + if (matcher->matches_inner_ethertype) { + ver =3D MLX5_GET(fte_match_param, match_param, + inner_headers.ethertype); + inner_ipv_ether =3D hws_rule_ethertype_to_matcher_ipv(ver); + } + if (matcher->matches_inner_ip_version) { + ver =3D MLX5_GET(fte_match_param, match_param, + inner_headers.ip_version); + inner_ipv_ip =3D hws_rule_ip_version_to_matcher_ipv(ver); + } + + if (inner_ipv_ether !=3D MLX5HWS_MATCHER_IPV_UNSET && + inner_ipv_ip !=3D MLX5HWS_MATCHER_IPV_UNSET && + inner_ipv_ether !=3D inner_ipv_ip) { + mlx5hws_err(ctx, "Rule matches on inconsistent inner ethertype and ip ve= rsion\n"); + return -EINVAL; + } + + inner_ipv =3D inner_ipv_ether !=3D MLX5HWS_MATCHER_IPV_UNSET ? + inner_ipv_ether : inner_ipv_ip; + if (inner_ipv !=3D MLX5HWS_MATCHER_IPV_UNSET && + matcher->inner_ip_version !=3D MLX5HWS_MATCHER_IPV_UNSET && + inner_ipv !=3D matcher->inner_ip_version) { + mlx5hws_err(ctx, "Matcher and rule disagree on inner IP version\n"); + return -EINVAL; + } + matcher->inner_ip_version =3D inner_ipv; + + return 0; +} + +static int hws_rule_check_ip_version(struct mlx5hws_matcher *matcher, + u32 *match_param) +{ + int ret; + + ret =3D hws_rule_check_outer_ip_version(matcher, match_param); + if (unlikely(ret)) + return ret; + + ret =3D hws_rule_check_inner_ip_version(matcher, match_param); + if (unlikely(ret)) + return ret; + + return 0; +} + int mlx5hws_rule_create(struct mlx5hws_matcher *matcher, u8 mt_idx, u32 *match_param, @@ -665,6 +783,10 @@ int mlx5hws_rule_create(struct mlx5hws_matcher *matche= r, { int ret; =20 + ret =3D hws_rule_check_ip_version(matcher, match_param); + if (unlikely(ret)) + return ret; + rule_handle->matcher =3D matcher; =20 ret =3D hws_rule_enqueue_precheck_create(rule_handle, attr); --=20 2.34.1